• 3 min read
HollowGraph hides malware C2 in Microsoft 365 calendars
HollowGraph hides C2 commands and stolen data in Microsoft 365 calendar events, targeting Israeli organizations through Microsoft Graph.
Image: BleepingComputer
A malware component called HollowGraph is abusing the calendar feature in compromised Microsoft 365 mailboxes to receive attacker commands and exfiltrate stolen data. Researchers believe it is part of the Cavern command-and-control framework, previously linked to an Iranian threat actor targeting organizations in Israel.
At least 12 systems have been infected. Three were actively communicating with the attacker between June 3 and July 9, and the available indicators point to a targeted espionage campaign focused on Israeli organizations.
How HollowGraph abuses Microsoft 365 calendars
According to cybersecurity company Group-IB, HollowGraph uses hardcoded credentials to authenticate to the Microsoft Graph API through a compromised Microsoft 365 account. Its configuration is stored as logAzure.txt, a filename chosen to resemble an ordinary log. The file contains the Microsoft Entra ID tenant ID, application client ID, client secret, target mailbox, command-and-control domain, and two RSA keys.
Recommended reading
Ostium loses $23.75 million in price-feed attack
The keys encrypt files sent to the attacker and decrypt incoming instructions. HollowGraph creates calendar events dated May 13, 2050, using specific subject formats to hide its activity. Commands and stolen data are stored in attachments to those events.
The malware supports two commands:
- GET searches for events matching Event ID: <7-char-taskID>, then downloads and decrypts instructions.
- SEND creates an event matching Boss{..}ID{..} and attaches data encrypted with the attacker’s public RSA key.
Group-IB describes the mailbox calendar as a “covert dead-drop.” HollowGraph searches for instructions scheduled within a fixed one-hour window, from 22:00 to 23:00 UTC on May 13, 2050. Communications use a hybrid encryption scheme combining RSA and AES-256-GCM, with separate cryptographic protection for inbound and outbound traffic.
DNS tunneling refreshes Microsoft Graph credentials
HollowGraph also has an unencrypted DNS tunneling channel that retrieves updated Microsoft Entra ID details: the tenant ID, client ID, client secret, and mailbox address. It queries IPv6 AAAA records for the attacker-controlled domain cloudlanecdn[.]com, then updates the logAzure.txt configuration.
Each IPv6 address provides 14 usable payload bytes out of its 16 bytes. The malware combines those chunks, decodes them as UTF-8 text, and stores the resulting values in the relevant configuration fields.
“HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity.”
Group-IB could not confidently attribute HollowGraph to a known threat actor, though its analysis found technical similarities to the Iranian-nexus Lyceum group. Researchers assess with high confidence that the malware is linked to the Cavern framework.
Organizations should monitor Microsoft Graph and Microsoft 365 audit logs for application-driven calendar activity, especially far-future events, unusual subjects, and unexpected attachments. Group-IB also recommends checking for cloudlanecdn[.]com and logAzure.txt, enforcing Conditional Access, auditing OAuth client-credential applications, and monitoring outbound DNS for tunneling patterns.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
